Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-15312

Publication date:

01/07/2020

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to be vulnerable to DNS rebinding. Combined with one of the many /httpapi.asp endpoint command-execution security issues, the DNS rebinding attack could allow an attacker to compromise the victim device from the Internet.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-14196

Publication date:

01/07/2020

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-7688

Publication date:

01/07/2020

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.

Severity CVSS v4.0: Pending analysis

Last modification:

14/07/2020

CVE-2020-14057

Publication date:

01/07/2020

Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to gain remote code execution in common deployments.

Severity CVSS v4.0: Pending analysis

Last modification:

08/07/2020

CVE-2020-13619

Publication date:

01/07/2020

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-14055

Publication date:

01/07/2020

Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding.

Severity CVSS v4.0: Pending analysis

Last modification:

08/07/2020

CVE-2020-14056

Publication date:

01/07/2020

Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services.

Severity CVSS v4.0: Pending analysis

Last modification:

08/07/2020

CVE-2020-6089

Publication date:

01/07/2020

An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted ANI file can cause a buffer overflow resulting in remote code execution. An attacker can provide a malicious file to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

12/05/2022

CVE-2020-2500

Publication date:

01/07/2020

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2020

CVE-2020-12497

Publication date:

01/07/2020

PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2023

CVE-2020-12498

Publication date:

01/07/2020

mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2020

CVE-2020-5902

Publication date:

01/07/2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2025

Subscribe to Vulnerabilities